0

I'm generating payloads with MSFVenom and here's a sample output:

user@localhost:~ $ msfvenom -p windows/shell_bind_tcp -b '\x00\x0a\x0d\x20' -i 3 -n 200 -f python
No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x86 from the payload
Found 22 compatible encoders
Attempting to encode payload with 3 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 355 (iteration=0)
x86/shikata_ga_nai succeeded with size 382 (iteration=1)
x86/shikata_ga_nai succeeded with size 409 (iteration=2)
Successfully added NOP sled from x86/opty2
buf =  ""
buf += "\xb1\xbb\x92\xb5\xba\x3d\xb3\x7f\x78\x75\x3f\xa8\x70"
buf += "\x7e\x7f\x78\x73\x76\x7d\x79\x71\x72\x08\xe2\x3d\x89"
...
buf += "\xd7\x7d\x08\xa6\xbf\x4d\x40\x33\xd1\x3c\x45\x60\x0c"
buf += "\xfe\x3e\xbc\x2f\x68\x12\x79\x54\xe1\x52\x49"

In this case the -n 200 option is to append a 200 byte NOP slep, but it's not visible in the payload. I'm guessing it's using some kind of encoding for the NOP sled (is that what Successfully added NOP sled from x86/opty2 means?)

What I'm trying to understand: the purpose of a NOP sled is to slide into the shellcode, if the NOP sled needs to be decoded first, does that not beat the point? What is the advantage here?

EDIT:

Here's a sample output without the -n 200. I don't understand how this could be the same total length.

user@localhost:~ $ msfvenom -p windows/shell_bind_tcp -b '\x00\x0a\x0d\x20' -i 3 -f python
No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x86 from the payload
Found 22 compatible encoders
Attempting to encode payload with 3 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 355 (iteration=0)
x86/shikata_ga_nai succeeded with size 382 (iteration=1)
x86/shikata_ga_nai succeeded with size 409 (iteration=2)
buf =  ""
buf += "\xda\xdf\xba\x09\x7e\x1f\x39\xd9\x74\x24\xf4\x58\x2b"
...
buf += "\xab\xbe\x3e\x2e\x12\xf8\x76\xb1\xad\x34\x21\x43\x21"
buf += "\xd8\xe1\xf8\x2e\x3d\x5b"

The only difference is the lack of the line Successfully added NOP sled from x86/opty2

closed as off-topic by schroeder, Eric G, Mark, M'vy, Stephane Mar 18 '15 at 8:58

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder, Eric G, Mark, M'vy, Stephane
If this question can be reworded to fit the rules in the help center, please edit the question.

  • What were you expecting to see? Have you Googled what a NOP sled looks like in this context? – schroeder Mar 17 '15 at 21:22
  • Here's a test - run the same command without the sled, then with it. Does the resulting payload increase by 200 bytes? – schroeder Mar 17 '15 at 21:23
  • @schroeder the NOPs sleds I've seen before were literally X times 0x90 before the rest of the shellcode. That's not what I see here. Running the same command without the -n 200 produces output of the exact same length. – Juicy Mar 17 '15 at 21:27
  • 1
    in your screenshot, the 2 outputs look different sizes to me – schroeder Mar 17 '15 at 21:33
  • 1
    no problem - the encoder works on the main code first, then an encoded version of the sled is appended – schroeder Mar 17 '15 at 21:35
2

Your NOP sled is there, it's just encoded. If you compare the actual end output, you can see that the 2 buffers are different lengths if you don't use a sled.

The line: 86/shikata_ga_nai succeeded with size 355 indicates the size of the main payload before the appending of the sled, so that reported size will not differ with or without a sled.

  • 3
    Also people usually assume nops can only be implemented as \x90. Any x86 assembly op-codes can be used as nops. For example, push eax, xor eax,eax, mov eax, 123h, sub eax, 1, pop eax is a nop operation since the effective instructions are only push eax and pop eax. – void_in Mar 18 '15 at 6:19
  • @void_in that too. – schroeder Mar 18 '15 at 17:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.